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In order to identify the extent to which results from topological graph models are 
useful for modeling vulnerability in electricity infrastructure, we measure the sus- 
ceptibility of power networks to random failures and directed attacks using three 
measures of vulnerability: characteristic path lengths, connectivity loss and blackout 
sizes. The first two are purely topological metrics. The blackout size calculation 
results from a model of cascading failure in power networks. Testing the response of 
40 areas within the Eastern US power grid and a standard IEEE test case to a variety 
of attack/failure vectors indicates that directed attacks result in larger failures using 
all three vulnerability measures, but the attack vectors that appear to cause the most 
damage depend on the measure chosen. While our topological and power grid model 
results show some trends that are similar, there is only a mild correlation between 
the vulnerability measures for individual simulations. We conclude that evaluating 
vulnerability in power networks using purely topological metrics can be misleading. 



Electricity infrastructures are vital to 
the operation of modern society, yet 
they are notably vulnerable to cascad- 
ing failures. Understanding the na- 
ture of this vulnerability is fundamen- 
tal to the assessment of electric energy 
reliability and security. A number of 
articles have recently used topological 
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(graph theoretic) models to assess vul- 
nerability in electricity systems. In this 
article we illustrate that under some 
circumstances these topological models 
can lead to provocative, but ultimately 
misleading conclusions. We argue that 
emperical comparisons between topo- 
logical models and higher fidelity mod- 
els are neccessary in order to draw firm 
conclusions about the utility of com- 
plex networks methods. 



I. INTRODUCTION 

Motivated by the importance of reli- 
able electricity infrastructure, numerous re- 
cent papers have applied complex networks 
methods^ to study the structure and func- 
tion of power grids. Results from these stud- 
ies differ greatly. Some measure the topol- 
ogy of power grids and report exponential 
degree distributions^^, whereas others re- 
port power-law distributions 6 1 . Some mod- 
els of the North American power grid sug- 
gest that power grids are more vulnerable to 
directed attacks than to random failures^, 
even though power grids differ from from 
scale-free networks in topology. Recently, 
Wang and Rong^ used a topological model of 
cascading failure and argue that attacks on 
nodes (buses) transporting smaller amounts 
of power can result in disproportionately 
large failures. Albert et alP draw the oppo- 
site conclusion using similar data. Because of 
the potential implications of these results for 
infrastructure security, these papers^ have 
attracted the attention of government and 
medial. 

The value of purely topological models of 
power grid failure in assessing actual fail- 
ure modes in the electricity infrastructure 
is not well-established. Commodity (elec- 



tric energy) flows in electricity networks 
are governed by Ohm's law and Kirchhoff's 
laws, which are not captured particularly 
well in simple topological models (see Figjl]). 
Some have identified relationships between 
the physical properties of power grids and 
topological metrics^* 11 * 12 *, and find that some 
metrics do correlate to measures of power sys- 
tem performace. However, to our knowledge, 
no existing research has systematically com- 
pared the results from a power-flow based 
cascading failure vulnerability model with 
those from graph theoretic models of vul- 
nerability. Because cascading failures (and 
hurricanes) cause the largest blackouts^ and 
contribute disproportionately to overall re- 
liability riskP^, models that incorporate the 
possibility of cascading failure are necessary 
to provide a sufficiently broad view of power 
network vulnerability. While there is exten- 
sive literature on cascading failure and con- 
tagion in abstract networks (see, e.g., Sec. 4 
oP), and some application of these methods 
to power networks^, direct comparisons are 
needed to draw firm conclusions about the 
utility of topological methods. 

Our primary goal, therefore, is is to com- 
pare the vulnerability conclusions that result 
from topological measures of network vulner- 
ability with those that result from a more re- 
alistic model of power network failure. We 
draw on existing literature (particularly^^) 




Figure 1. An illustration of the difference be- 
tween a topological (nearest-neighbor) model of 
cascading failure and one based on Kirchhoff's 
laws. a. Node 2 fails, which means that its power 
flow (load) must be redistributed to functioning 
nodes, b. In many topological models of cascad- 
ing failure (e.g.J^j), load from failed components is 
redistributed to nearest neighbors (Nodes 1 and 
3). c. In an electrical network current re-routes 
by Kirchhoff's laws, which in this case means 
that the power that previously traveled through 
Node 2 is re-routed through Nodes 5 and 6. In 
addition, by Kirchhoff's laws, Node 3 ends up 
with no power-flow. 

to choose the topological vulnerability mea- 
sures used in this paper. 

II. VULNERABILITY MEASURES 

Our first vulnerability measure is charac- 
teristic path length (0 < L < oo), which is 
the average distance among node pairs in a 
graph. In 16 , path length (network diameter) 



was suggested as a measure of network vul- 
nerability because as more components fail 
nodes become more distant, which may indi- 
cate that flows within the network are inhib- 
ited. 

The second measure is connectivity loss 
(0 < C < 1), which was proposed irP as a 
way to incorporate the locations of sources 
(generators) and sinks (loads) into a measure 
of network vulnerability. Connectivity loss 
is defined: C — 1 — (n g /n g ^j where n g is 
the number of generators in the network and 
n g is the number of generators that can be 
reached by traveling from node i across non- 
failed links. 

The third measure, which does not appear 
in the existing network science literature, is 
blackout sizes as calculated from a model of 
cascading failure in a power system. While 
a perfect model of cascading failure would 
accurately represent the continuous dynam- 
ics of rotating machines, the discrete dy- 
namics associated with relays that disconnect 
stressed components from the network, the 
non-linear algebraic equations that govern 
flows in the network, and the social dynam- 
ics of operators working to mitigate the ef- 
fects of system stress, all power system mod- 
els simplify these dynamics to some extent. 
Unlike simple topological metrics, our model 
does capture the effects of Ohm's and Kirch- 
hoff's laws, by using linear approximations of 



the non-linear power flow equations^. Simi- 
lar models have been used to study cascading 
failure in a number of recent papers^* 18 * 19 !. 

In our model, when a component fails, 
the "DC power-flow" equations are used to 
calculate changes in network flow patterns. 
In the DC approximation the net power in- 
jected into a node (generation minus load: 
Pi = P g .i—Pd,i) is equal to the total amount of 
power flowing to neighboring nodes through 
links (transmission lines or transformers): 
Pi = — where is the voltage 

phase angle at node i, and is the series 
reactance of the link(s) between nodes i and 
j. Each link has a relay that removes it from 
service if its current exceeds 50% of its rated 
limit for 5 seconds or more. The trip-time 
calculations are weighted such that the relays 
will trip faster given greater overloads. While 
it is true that over-current relays are not uni- 
versally deployed in high-voltage power sys- 
tems, they provide a good approximation of 
other failure mechanisms that are common, 
such as lines sagging into underlying vegeta- 
tion (an important contributor to the August 
14, 2003 North American blackout 20 ). Af- 
ter a component fails the model recalculates 
the power flow and advances to the time at 
which the next component will fail, or quits 
if no further components are overloaded. If 
a component failure separates the grid into 
unconnected sub-grids, the following process 



is used to re-balance supply and demand. If 
the imbalance is small, such that generators 
can adjust their output by not more than 
10% and arrive at a new supply/demand bal- 
ance, this balance is achieved through gen- 
erator set-point adjustments. If this adjust- 
ment is insufficient, the smallest generator in 
the sub-grid is shut down until there is an ex- 
cess of load. If there is excess load after these 
generator adjustments, the simulator curtails 
enough load to balance supply and demand. 
This balancing process approximates the pro- 
cess that automatic controls and operators 
follow to balance supply and demand during 
extreme events. The size of the blackout (S) 
is reported at the end of the simulation as the 
total amount of load curtailed. 

III. ATTACK VECTORS 

In order to measure power network vul- 
nerability, we test the response of 41 elec- 
tricity networks to a variety of exogenous 
disturbance vectors (attacks or random fail- 
ures). In each case we measure the relation- 
ship between disturbance (attack or random 
failure) size and disturbance cost using the 
three vulnerability measures described above. 
To compare our results with prior research 
five disturbance vectors are simulated. These 
are described as follows. 

The first vector is random failure, in which 



nodes (buses) are selected for removal by ran- 
dom selection, with an equal failure probabil- 
ity for each node. This approach simulates 
failure resulting from natural causes (e.g., 
storms) or an unintelligent attack. For each 
network, we test its response to 20 unique 
sets of random failures, with 10 nodes in each 
set. These sets are initially selected from a 
uniform distribution, and then applied incre- 
mentally (one node, then two nodes, etc.). 

The second vector is degree attack, in 
which nodes are removed incrementally, 
starting with the highest degree (connectiv- 
ity) nodes. This strategy represents an intel- 
ligent attack, in which the attacker chooses to 
disable nodes with a large number of neigh- 
boring nodes. 

The third vector is a maximum-traffic at- 
tack, in which nodes are removed incremen- 
tally starting with those that transport the 
highest amounts of power. We use the term 
"traffic" to differentiate this measure from 
"load," which frequently describes the quan- 
tity of power being consumed at a node. 
Thus traffic (T) is similar to the measures de- 
scribed as load in 49 . The following measure 
of node-loading is used to select maximum- 
traffic nodes: Tj = \Pj\ + J2j |(#; ~~ 

The fourth vector is minimum-traffic at- 
tack, which is the inverse of the max-traffic 
attack. This vector is used for comparison 
with the conclusions irP, which argues that 



failures at low-traffic (load) nodes lead to 
larger blackouts than failures at high-traffic 
nodes. 

The fifth vector is betweenness attack, 
in which nodes are removed incrementally, 
starting with those that have the highest be- 
tweenness centrality (the number of shortest 
paths that pass through a node^). This vec- 
tor was used irP to approximate an attack on 
high traffic (load) nodes, and was reported to 
result in disproportionately large failures. 

IV. RESULTS 

To compare the vulnerability measures we 
report results from the simulation of random 
failures and directed attacks for a common 
test system (IEEE 300 bus test case) and 40 
of 136 control areas from within the North 
American Eastern Interconnect (EI). The EI 
data come from a North American Electric 
Reliability Corporation power-flow planning 
case, to which the authors have been granted 
access for the purpose of this research.^ 
The 40 control areas analyzed were selected 
because of their proximate sizes (336-1473 
nodes). Together they represent 29,261 of 
49,907 nodes (buses) in the Eastern Inter- 
connect data. We initialized the simulations 
to provide an initial balance between supply 
and demand by decreasing either load or gen- 
eration, whichever was initially greater. In a 



few areas the base-case power flows exceeded 
the rated flow limits. In these cases we in- 
creased the line limits until all power flows 
were 10% below the flow limits. Actual lo- 
cations have been deleted from our data set, 
such that these results are not linked to phys- 
ical locations in the US electricity infrastruc- 
ture. 

The upper panels of Figs. [2] and [3] show 
how path lengths (L) change as nodes are re- 
moved from the test networks. In both the 
IEEE 300 bus network and the EI areas path 
lengths resulting from degree-based, max- 
traffic, and betweenness attacks is greater 
than the average L from random failures. 
Min-trafhc attacks do not substantially dif- 
fer from random failures in this measure. 

The middle panels of Figs. [2] and [3] illus- 
trate the difference between the connectivity 
losses (C) from directed attacks and C from 
random failure. From this semi-topological 
perspective, power grids are notably more 
vulnerable to directed attacks than to ran- 
dom failure, and are thus similar to scale-free 
networks (see^for a similar result). 

The blackout size results (lower pan- 
els of Figs. [2] and [3]) also indicate that 
power networks are notably more vulnerable 
to directed (degree-based, max-traffic- and 
betweenness-based) attack than they are to 
random failure. Max-traffic attacks on 10 
nodes produce blackouts with an average size 



of 72%. Random failure of 10 nodes results 
in an average blackout size of 20%, and min- 
traffic attacks produced much smaller black- 
outs (5% average). From these results it ap- 
pears that the prediction irF that attacks on 
low-traffic nodes lead to large failures is not 
accurate. Note that the measure of traffic 
(load) used 9 is different than ours, but it 
would be incorrect to conclude that failures 
at low power-flow nodes contribute substan- 
tially to system vulnerability. 

While trends in the path length, connec- 
tivity loss and blackout size measures are sim- 
ilar after averaging over many simulations, 
the correlation between measures for individ- 
ual simulations is poor. Because connectiv- 
ity loss does not directly account for cas- 
cading failure, it roughly predicts only the 
minimum size of the resulting blackout (see 
Fig. [i]). Once triggered, the complex inter- 
actions among network components during a 
cascading event can result in a blackout of al- 
most any size. Many disturbances with small 
connectivity loss (<10%) produced very large 
blackouts. 

Another notable difference among the 
model results is that one would draw different 
conclusions about the most dangerous attack 
vectors, depending on the vulnerability mea- 
sure used. From path lengths, betweenness 
attacks have the greatest impact. From con- 
nectivity loss, degree-based attacks look most 



dangerous. From the blackout model, max- 
traffic attacks appear to contribute most to 
vulnerability. 

V. CONCLUSIONS 

Together these results indicate that while 
topological measures can provide some indi- 
cation of general vulnerability trends, they 
can also be misleading when used in isolation. 
In some cases, overly-abstracted topological 
models can result in erroneous conclusions, 
which could lead to mis-allocation of risk- 
mitigation resources. Vulnerability measures 
that properly account for network behavior 
as well as the arrangement of sources and 
sinks produce substantially different results; 
we argue that these results are more realistic 
and more useful for infrastructure risk assess- 
ment. If the results described here are similar 
to what one would obtain from an ideal model 
of cascading failure, the implication for elec- 
tricity infrastructure protection is that the 
defense of high-traffic, high-degree, and high- 
betweenness substations from attack is likely 
to be a cost-effective risk mitigation strategy. 
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Figure 2. (color online). Simulated response of 
the IEEE 300 bus network to directed attacks. 
The top panel shows the change in characteris- 
tic path lengths (L) as the number of failures 
increases. The middle panel shows connectivity 
loss (C) and the bottom panel shows the size 
of the resulting blackout both as a function of 
the number of components failed. The results 
for random failures are averages over 20 trials. 
The trajectories shown are differences between 
the attack-vector results and the random failure 
averages. Shading indicates ±la for the random 
failures. 
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Figure 3. (color online). Simulated response of 
40 control areas in the Eastern Interconnect net- 
work to directed attacks. The top panel shows 
the average characteristic path lengths (L) as 
the number of failures increases. The middle 
panel shows connectivity loss (C) and the bot- 
tom panel shows the size of the resulting black- 
out both as a function of the number of compo- 
nents failed. The results for random failures are 
averages over 20 trials in each of the 40 areas. 
The trajectories shown are differences between 
the attack-vector results (averaged over the 40 
areas) and the random failure averages. Shading 
indicates ±lcr for the random failures. 
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Figure 4. (color online). The correlation between 
blackout sizes and connectivity loss (C) for 40 
areas within the EI network. The correlation co- 
efficients corresponding to each attack vector are 
as follows: p = 0.210 (random failure), p = 0.621 
(degree attack), p = 0.551 (max-traffic attack), 
p = 0.288 (min-traffic attack), p = 0.138 (be- 
tweenness attack), and p = 0.477 (all simula- 
tions). 
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